CN112702321B - Distributed transaction current limiting method, device, equipment and storage medium - Google Patents

Abstract

The invention belongs to the technical field of computer security, and discloses a distributed transaction current limiting method, a distributed transaction current limiting device, distributed transaction current limiting equipment and a storage medium. The method comprises the steps of obtaining transaction behavior statistical parameters of a user according to a transaction request data packet; judging whether the transaction behavior statistical parameters accord with preset transaction behavior parameters or not, and generating a defense request and sending the defense request to a defense request server when the transaction behavior statistical parameters do not accord with the preset transaction behavior parameters so that the defense request server can determine a current limiting node through the defense request and a preset current limiting decision; and receiving a current limiting node fed back by the defense request server, and controlling the transaction flow of the user according to the current limiting node. In the invention, the transaction flow of the user on the financial platform is controlled by adopting a flow rate limiting technology, the limited network resources of the financial platform are ensured not to be consumed by the attack flow, the flow is controlled within the bearing capacity range of the limited resources, and the distributed transaction flow limiting method can effectively resist DDoS attack.

Description

Distributed transaction current limiting method, device, equipment and storage medium

technical field

The invention relates to the technical field of computer security, in particular to a distributed transaction current limiting method, device, equipment and storage medium.

Background technique

With the rapid development of modern financial platforms, users' requirements for the network service capabilities of financial platforms are also increasing. Due to the limitation of network bandwidth, network facilities and other factors, the efficiency of financial platform network services can be improved through distributed networks. A typical distributed network can enable users to access the content of financial platforms nearby, which greatly improves the transaction efficiency of financial platforms.

However, Denial of Service (DoS) attack is a form of attack that prevents legitimate users from receiving normal service responses. Attackers generally use a large number of illegal attack packets to occupy too many service resources to achieve the purpose of attack. Distributed Denial of Service Distributed Denial of Service (DDoS) attacks are more powerful, and attackers use a large number of puppet hosts to complete larger-scale denial of service attacks. As ready-made attack tools are rampant on the Internet, it is becoming easier and easier to launch such attacks, and the raging network worms in recent years have also contributed to the development of DDoS attacks. At present, DDoS attacks have become a financial platform transaction The most threatening and destructive form of attack in the network makes financial platforms have great transaction risks.

The above content is only used to assist in understanding the technical solution of the present invention, and does not mean that the above content is admitted as prior art.

Contents of the invention

The main purpose of the present invention is to provide a distributed transaction current limiting method, device, equipment and storage medium, aiming to solve the technical problem that existing distributed denial of service attacks cause great transaction risks in the financial platform transaction network.

In order to achieve the above object, the present invention provides a distributed transaction current limiting method, the method includes the following steps:

When receiving the user's transaction request data packet, obtain the user's transaction behavior statistical parameters according to the transaction request data packet;

Judging whether the statistical parameters of the transaction behavior conform to the preset transaction behavior parameters;

When the transaction behavior statistical parameters do not meet the preset transaction behavior parameters, generate a defense request and send the defense request to the defense request server, so that the defense request server passes the defense request and the preset current limit Decision-making to determine the current limiting node;

The current-limiting node that receives the feedback from the defense request server controls the user's transaction flow according to the current-limiting node.

Optionally, the step of judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters includes:

Acquiring the predicted normal behavior flow value according to the preset transaction behavior parameters, and obtaining the current transaction behavior flow value according to the transaction behavior statistical parameters;

Comparing the predicted normal behavior flow value with the current transaction flow value to obtain a transaction flow innovation sequence;

Analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis result.

Optionally, the step of analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis results includes:

Determining corresponding statistical features according to the transaction flow innovation sequence;

analyzing the statistical features based on a preset multivariate sequential analysis algorithm to obtain sample statistics;

performing a correlation analysis on the sample statistics according to a preset correlation test algorithm to obtain a correlation analysis result;

According to the correlation analysis result, it is judged whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters.

Optionally, the step of obtaining statistical parameters of the user's transaction behavior according to the transaction request data packet includes:

Obtain data packet header and timing information according to the transaction request data packet;

Obtaining the characteristic information of the data packet header and the timing information, and generating a current transaction behavior flow value according to the characteristic information;

Generate transaction behavior statistical parameters of the user according to the current transaction behavior flow value.

Optionally, before the step of judging whether the transaction behavior statistical parameters meet the preset transaction behavior parameters, it also includes:

Build a transaction normal flow model;

Obtaining predicted normal behavior flow values through the transaction normal flow model based on a preset time series analysis algorithm;

Generate preset transaction behavior parameters according to the predicted normal behavior flow value.

Optionally, the step of generating a defense request and sending the defense request to a defense request server, so that the defense request server determines a current limiting node through the defense request and a preset current limiting decision, includes:

Generate a defense request and send the defense request to the defense request server, so that the defense request server builds a traffic tree through the defense request and a preset attack source tracking strategy, determines the target attack subtree according to the traffic tree, and according to The preset current limiting decision determines the current limiting node through the target attack subtree.

Optionally, the step of controlling the user's transaction flow according to the rate-limiting node receiving the feedback from the defense request server includes:

receiving the current limiting node fed back by the defense request server, and determining leaf node information corresponding to the current limiting node;

determining the current limiting quota corresponding to the current limiting node according to the leaf node information, and determining the preset packet loss probability according to the preset current limiting decision;

User transaction traffic is controlled according to the current limit quota and the preset packet loss probability.

In addition, in order to achieve the above purpose, the present invention also proposes a distributed transaction current limiting device, the distributed transaction current limiting device includes:

An acquisition module, configured to obtain the user's transaction behavior statistical parameters according to the transaction request data packet when receiving the user's transaction request data packet;

A judging module, configured to judge whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters;

A decision-making module, configured to generate a defense request and send the defense request to a defense request server when the transaction behavior statistical parameters do not meet the preset transaction behavior parameters, so that the defense request server passes the defense request Determine the current limiting node with the preset current limiting decision;

The control module is configured to receive the current-limiting node fed back by the defense request server, and control user transaction flow according to the current-limiting node.

In addition, in order to achieve the above object, the present invention also proposes a distributed transaction current limiting device, which is characterized in that the distributed transaction current limiting device includes: a memory, a processor and a A distributed transaction current limiting program running on the processor, the distributed transaction current limiting program is configured to implement the steps of the distributed transaction current limiting method as described above.

In addition, in order to achieve the above object, the present invention also proposes a storage medium, which is characterized in that a distributed transaction current limiting program is stored on the storage medium, and when the distributed transaction current limiting program is executed by the processor, the above-mentioned The steps of the distributed transaction current limiting method.

The present invention obtains the user's transaction behavior statistical parameters according to the transaction request data packet when receiving the user's transaction request data packet; judges whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters; When the parameters do not meet the preset transaction behavior parameters, generate a defense request and send the defense request to the defense request server, so that the defense request server determines the current limiting node through the defense request and the preset current limiting decision; The current-limiting node that receives the feedback from the defense request server controls the user's transaction flow according to the current-limiting node. In the present invention, the flow rate limiting technology is used to control the user's transaction flow on the financial platform, to ensure that the limited network resources of the financial platform are not exhausted by the attack flow, and to control the flow within the capacity of the limited resources. The current limiting method can effectively resist DDoS attacks and solve the technical problem that the existing distributed denial-of-service attacks cause great transaction risks in the financial platform transaction network.

Description of drawings

Fig. 1 is a schematic structural diagram of a distributed transaction current-limiting device in a hardware operating environment involved in an embodiment of the present invention;

Fig. 2 is a schematic flow chart of the first embodiment of the distributed transaction current limiting method of the present invention;

Fig. 3 is a schematic flow chart of the second embodiment of the distributed transaction current limiting method of the present invention;

Fig. 4 is a schematic flow chart of the third embodiment of the distributed transaction current limiting method of the present invention;

Fig. 5 is a structural block diagram of the first embodiment of the distributed transaction current limiting device of the present invention.

The realization of the purpose of the present invention, functional characteristics and advantages will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Referring to FIG. 1 , FIG. 1 is a schematic structural diagram of a distributed transaction current limiting device in a hardware operating environment involved in an embodiment of the present invention.

As shown in FIG. 1 , the distributed transaction current limiting device may include: a processor 1001, such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Wherein, the communication bus 1002 is used to realize connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure shown in Figure 1 does not constitute a limitation on the distributed transaction current limiting device, and may include more or less components than shown in the figure, or combine some components, or different components layout.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a distributed transaction flow limiting program.

In the distributed transaction current limiting device shown in Figure 1, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processing in the distributed transaction current limiting device of the present invention The processor 1001 and the memory 1005 can be set in the distributed transaction current limiting device, and the distributed transaction current limiting device calls the distributed transaction current limiting program stored in the memory 1005 through the processor 1001, and executes the distributed transaction current limiting program provided by the embodiment of the present invention. Type transaction current limiting method.

An embodiment of the present invention provides a distributed transaction current limiting method. Referring to FIG. 2 , FIG. 2 is a schematic flowchart of a first embodiment of a distributed transaction current limiting method according to the present invention.

In this embodiment, the distributed transaction current limiting method includes the following steps:

Step S10: When receiving the user's transaction request data packet, obtain the user's transaction behavior statistical parameters according to the transaction request data packet.

It should be noted that the executor of this embodiment is the distributed transaction current limiting device, and the distributed transaction current limiting device may be an electronic device such as a personal computer or a server, which is not limited in this embodiment. When receiving the transaction request data packet from the user, the statistical parameters of the user's transaction behavior can be obtained according to the transaction request data packet, which can be realized in a variety of ways. The following two methods are used as examples to illustrate. Of course, you can also use Combination of at least two ways to achieve. In addition, the method of acquiring the statistical parameters of the user's transaction behavior according to the transaction request data packet may be other methods according to the actual situation, which is not limited in this embodiment. Wherein, the user's transaction request may be operations such as registration, transaction, transfer, and transfer of financial assets performed by the user on the financial platform, and this embodiment does not limit specific transaction operations.

Specifically, one of the ways to obtain the user's transaction behavior statistical parameters according to the transaction request data packet is: obtain the data packet header and timing information according to the transaction request data packet; obtain the characteristics of the data packet header and the timing information information, and generate the current transaction behavior flow value according to the characteristic information; generate the user's transaction behavior statistical parameters according to the current transaction behavior flow value. Among them, the transaction request data packet of the current system network is obtained, the characteristic data collection is performed on the behavior characteristics of the transaction request data packet, and the header and timing information of the data packet are obtained. time series of parameters to get time series information. In addition, the time-series feature changes of multiple parameters can also be used for detection and analysis, and more types of traffic anomalies can be detected in a wider range.

Specifically, another way to obtain the user's transaction behavior statistical parameters according to the transaction request data packet is: obtain the transaction request data packet of the current system network, collect the characteristic data of the behavior characteristics of the transaction request data packet, and analyze the collected The feature data is used to extract the network behavior statistical parameters, and the network behavior statistical parameters are used as the user's transaction behavior statistical parameters.

Step S20: judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters.

It should be understood that before the user's transaction request is distributed and limited, it is necessary to set the preset transaction behavior parameters. There are many ways to set the preset transaction behavior parameters. Let's take one of them as an example For illustration, of course, the method of setting the preset transaction behavior parameters can also be other methods according to the actual situation, which is not limited in this embodiment. Specifically, one of the ways to obtain the statistical parameters of the user's transaction behavior according to the transaction request data packet is: construct a normal transaction flow model; obtain the predicted normal behavior flow value through the normal transaction flow model based on a preset time series analysis algorithm; The predicted normal behavior flow value generates preset transaction behavior parameters.

It is easy to understand that a typical distributed network can enable users to access the content of the financial platform nearby, which greatly improves the transaction efficiency of the financial platform. However, the distributed network is widely distributed on multiple links in the communication network of the financial platform, which causes an attack on the communication network of the financial platform at the same time, and the abnormal network is distributed on multiple links in the communication network of the financial platform. From the perspective of the road, the abnormal traffic is small and difficult to detect. However, when multiple links are aggregated, the total abnormal traffic is very large, which can have a great impact on the operation of the communication network of the financial platform. In this embodiment, combined with the characteristic information of distributed network traffic abnormalities in the financial platform communication network, the preset time series analysis algorithm is used to obtain the predicted normal behavior traffic value, and the predicted normal behavior traffic value is compared with the current transaction behavior traffic value to generate a network Transaction flow innovation sequence of flow.

Specifically, the predicted normal behavior flow value is obtained according to the preset transaction behavior parameters, and the current transaction behavior flow value is obtained according to the transaction behavior statistical parameters; the predicted normal behavior flow value is compared with the current transaction behavior flow value , to obtain a transaction flow innovation sequence; analyze the transaction flow innovation sequence, and judge whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis result. Among them, the sequential analysis method can be used to analyze the characteristics of the transaction flow innovation sequence of multiple links to judge whether the transaction behavior statistical parameters meet the preset transaction behavior parameters, that is, to analyze whether the abnormal behavior of the distributed network traffic occurs, and then control the user transaction flow.

Step S30: When the transaction behavior statistical parameters do not meet the preset transaction behavior parameters, generate a defense request and send the defense request to the defense request server, so that the defense request server passes the defense request and the preset transaction behavior parameters. Let the current limiting decision determine the current limiting node.

It should be noted that when it is judged that the statistical parameters of transaction behavior do not meet the preset transaction behavior parameters, it is necessary to determine the current limiting node to analyze the abnormal behavior of distributed network traffic, and then control the user's transaction flow according to the current limiting node. Specifically, generate a defense request and send the defense request to the defense request server, so that the defense request server builds a traffic tree through the defense request and a preset attack source tracking strategy, and determines the target attacker according to the traffic tree. tree, and determine the current limiting node through the target attack subtree according to the preset current limiting decision. Among them, the defense request server DSP selects the attack source tracking (IP traceback) technology according to the specific situation, and can reconstruct a traffic tree with the abnormal behavior of network traffic as the root, and can separate the attack subtree from the traffic tree. The tracking results can obtain the most suitable current limiting position, that is, the current limiting node. The current limiting node is the leaf node of the traffic tree. According to the attack source tracking results, you can also know which current limiters the attack flow has passed through, so that it can be targeted Select the current limiting node for current limiting to improve the current limiting effect.

Step S40: The rate-limiting node that receives the feedback from the defense request server controls the user's transaction flow according to the rate-limiting node.

It should be understood that, receiving the current limiting node fed back by the defense request server, and determining the leaf node information corresponding to the current limiting node; determining the current limiting quota corresponding to the current limiting node according to the leaf node information, and determining the current limiting quota corresponding to the current limiting node according to the The preset current limiting decision determines the preset packet loss probability; the user transaction flow is controlled according to the current limit quota and the preset packet loss probability. Among them, the leaf node information is the basic information of each leaf node. The basic information can include such as node IP address, node status (whether current limiting, current limiting quota, current limiting time limit, whether there is attack flow passing through) and information collected from the node. Leaf node information is an important basis for controlling user transaction traffic, and leaf node information can also save the current limiting results obtained from preset current limiting decisions.

In this embodiment, when receiving the user's transaction request data packet, the user's transaction behavior statistical parameters are obtained according to the transaction request data packet; it is judged whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters; When the statistical parameters do not meet the preset transaction behavior parameters, generate a defense request and send the defense request to the defense request server, so that the defense request server determines the current limiting node through the defense request and the preset current limiting decision ; Receive the current limiting node fed back by the defense request server, and control the user transaction flow according to the current limiting node. In this embodiment, the flow rate limiting technology is used to control the user's transaction flow on the financial platform, to ensure that the limited network resources of the financial platform are not exhausted by the attack flow, and to control the flow within the capacity of the limited resources. The transaction flow limiting method can effectively resist DDoS attacks, and solve the technical problem that the existing distributed denial-of-service attacks cause great transaction risks in the financial platform transaction network.

Referring to FIG. 3 , FIG. 3 is a schematic flowchart of a second embodiment of a distributed transaction current limiting method according to the present invention. Based on the above-mentioned first embodiment, the distributed transaction current limiting method of this embodiment in the step S20 specifically includes:

Step S201: Obtain the predicted normal behavior flow value according to the preset transaction behavior parameters, and obtain the current transaction behavior flow value according to the transaction behavior statistical parameters.

It should be noted that before the user's transaction request is distributed to limit the transaction flow, it is necessary to set the preset transaction behavior parameters. The method of setting the preset transaction behavior parameters can be: building a normal transaction flow model; based on the preset time series analysis The algorithm obtains the predicted normal behavior flow value through the normal transaction flow model; generates preset transaction behavior parameters according to the predicted normal behavior flow value. The predicted normal behavior flow value can be obtained according to the preset transaction behavior parameters.

It is easy to understand that the data packet header and timing information are obtained according to the transaction request data packet; the characteristic information of the data packet header and the timing information is obtained, and the current transaction behavior flow value is generated according to the characteristic information; The transaction behavior statistics parameters of the user are generated by describing the current transaction behavior flow value. The current transaction behavior flow value can be obtained according to the transaction behavior statistical parameters.

Step S202: Compare the predicted normal behavior flow value with the current transaction flow value to obtain a transaction flow innovation sequence.

It should be understood that, comparing the predicted normal behavior flow value with the current transaction behavior flow value generates a predicted innovation sequence of network traffic, and the predicted innovation sequence of network traffic is a transaction traffic innovation sequence. In this embodiment, combined with the characteristic information of distributed network traffic abnormalities in the financial platform communication network, the preset time series analysis algorithm is used to obtain the predicted normal behavior traffic value, and the predicted normal behavior traffic value is compared with the current transaction behavior traffic value to generate a network Transaction flow innovation sequence of flow. Among them, the sequential analysis method can be used to analyze the characteristics of the transaction flow innovation sequence of multiple links to judge whether the transaction behavior statistical parameters meet the preset transaction behavior parameters, that is, to analyze whether the abnormal behavior of the distributed network traffic occurs, and then control the user transaction flow.

Step S203: Analyzing the new information sequence of transaction flow, and judging whether the statistical parameters of transaction behavior conform to preset transaction behavior parameters according to the analysis result.

It should be noted that the process of analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistics parameters conform to the preset transaction behavior parameters according to the analysis results may be: determine the corresponding Statistical characteristics; analyze the statistical characteristics based on a preset multivariate sequential analysis algorithm to obtain sample statistics; perform correlation analysis on the sample statistics according to a preset correlation test algorithm to obtain correlation analysis Result: judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the correlation analysis result. Among them, the statistical characteristics of the transaction flow innovation sequence corresponding to multiple links are analyzed based on the preset sequential analysis method, and the logarithmic probability likelihood ratio decision function is constructed to obtain the sample statistics. Using the similarity of distributed network anomalies in multiple links, based on the preset correlation test algorithm, the distributed network is analyzed by performing correlation analysis on the mutation values of the sample statistics corresponding to multiple links. Whether the abnormal traffic behavior occurs, it can be judged whether the statistical parameters of the transaction behavior conform to the preset transaction behavior parameters.

It is easy to understand that the network abnormal behavior sequence can be constructed by preset multi-sequential analysis algorithm, which can avoid the analysis of specific fine components in the network, but extract the abnormal space features in the network link for analysis, so that traffic detection Easier. By sequentially analyzing the transaction flow innovation sequences in different links on the same node in the network, the log probability likelihood ratio statistics can be obtained, that is, the sample statistics. Using the analysis variable of the mutation value of the maximum likelihood ratio in the sequential probability ratio test to reflect the characteristic information of the transaction flow innovation sequence, and indirectly by analyzing the correlation characteristics of the mutation value of the maximum likelihood ratio in two different links Analyze whether there is a distributed anomaly in the statistical parameters of trading behavior.

In this embodiment, the predicted normal behavior flow value is obtained according to the preset transaction behavior parameters, and the current transaction behavior flow value is obtained according to the transaction behavior statistical parameters; the predicted normal behavior flow value is compared with the current transaction behavior flow value Comparing to obtain a transaction flow innovation sequence; analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis result. In this embodiment, the flow rate limiting technology is used to control the user's transaction flow on the financial platform, to ensure that the limited network resources of the financial platform are not exhausted by the attack flow, and to control the flow within the capacity of the limited resources. The transaction flow limiting method can effectively resist DDoS attacks, and solve the technical problem that the existing distributed denial-of-service attacks cause great transaction risks in the financial platform transaction network.

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of a third embodiment of a distributed transaction current limiting method according to the present invention. Based on the above-mentioned first embodiment, the distributed transaction current limiting method of this embodiment in the step S40 specifically includes:

Step S401: Receive the current limiting node fed back by the defense request server, and determine leaf node information corresponding to the current limiting node.

It should be noted that the defense request server DSP selects the attack source tracing (IPtraceback) technology according to the specific situation, and can reconstruct a traffic tree with the abnormal behavior of network traffic as the root, and can separate the attack subtree from the traffic tree, according to The attack source tracking result can obtain the most suitable current limiting position, that is, the current limiting node. The current limiting node is the leaf node of the traffic tree. According to the attack source tracking result, it can also be known which current limiters the attack flow has passed. Targeted selection of current limiting nodes for current limiting to improve the effect of current limiting.

Specifically, receive the current limiting node fed back by the defense request server, and determine the leaf node information corresponding to the current limiting node; wherein, the leaf node information is the basic information of each leaf node, and the basic information may include, for example, the node IP address , node status (whether current limiting, current limiting quota, current limiting time limit, whether there is an attack flow passing through) and traffic information collected from the node, etc. Leaf node information is an important basis for controlling user transaction traffic. Leaf node information is also The current limiting result obtained by the preset current limiting decision can be saved.

Step S402: Determine the current limit quota corresponding to the current limit node according to the leaf node information, and determine the preset packet loss probability according to the preset current limit decision.

It should be understood that the current limit quota corresponding to the current limit node is determined according to the leaf node information. There are many specific current limit methods. Set the packet loss probability.

It is easy to understand that according to the attack source tracking results, it is possible to determine which flow limiters the attack flow has passed through. If only legitimate flows pass through the flow limiter, the defense request server DSP can preferentially allocate resources to the flow limiter. Resources are preferentially allocated to those current limiters that only legal traffic passes through, and the remaining resources can be fairly allocated to those traffic limiters that have been polluted by attack traffic according to the maximum and minimum criteria. Pollution does not mean that only attack traffic passes through, but also There may be legal traffic mixed in, and the preset traffic limiting policy can effectively protect legal traffic.

Step S403: Control the user's transaction flow according to the current limit quota and the preset packet loss probability.

It should be noted that, in order to prevent forged current limiting requests, after receiving the current limiting request, first verify the legality, and then perform the current limiting operation. There are many specific current limiting methods. This embodiment adopts the method of random packet loss. According to the current limit quota and the preset packet loss probability to control user transaction flow, the preset packet loss probability P can be determined by P=(0,1-Limit/Rate), where Limit refers to the current limit node Current limit quota, Rate refers to the current traffic size of the current limit node fed back by the defense request server, if Limit is greater than or equal to Rate, then the probability of packet loss is 0, that is, no current limit is required, according to the current limit limit of the current limit node itself To control user transaction flow, the current limiting node can control the size of user transaction flow within a certain range through random packet loss.

It is easy to understand that the preset current limit decision needs to be updated regularly to adapt to the dynamic changes of the environment, otherwise it will cause deviation in the current limit. The preset current limit decision update process: recalculate the current limit according to the decision algorithm, and according to the decision As a result, a new current-limiting command is issued, which may include adjusting the current-limiting quota and activating new current-limiting nodes.

In this embodiment, by receiving the current limiting node fed back by the defense request server, and determining the leaf node information corresponding to the current limiting node; according to the leaf node information, determining the current limiting quota corresponding to the current limiting node, and according to the predetermined Set the current limit decision to determine the preset packet loss probability; control the user transaction flow according to the current limit quota and the preset packet loss probability. In this embodiment, the flow rate limiting technology is used to control the user's transaction flow on the financial platform, to ensure that the limited network resources of the financial platform are not exhausted by the attack flow, and to control the flow within the capacity of the limited resources. The transaction flow limiting method can effectively resist DDoS attacks, and solve the technical problem that the existing distributed denial-of-service attacks cause great transaction risks in the financial platform transaction network.

In addition, the embodiment of the present invention also proposes a storage medium, on which a distributed transaction current limiting program is stored, and the distributed transaction current limiting program is executed by the processor as described above in the distributed transaction current limiting method A step of.

Since the storage medium adopts all the technical solutions of all the above-mentioned embodiments, it at least has all the beneficial effects brought by the technical solutions of the above-mentioned embodiments, which will not be repeated here.

Referring to FIG. 5 , FIG. 5 is a structural block diagram of the first embodiment of the distributed transaction current limiting device of the present invention.

As shown in Figure 5, the distributed transaction current limiting device described in the embodiment of the present invention includes:

The obtaining module 10 is configured to obtain the user's transaction behavior statistical parameters according to the transaction request data packet when receiving the user's transaction request data packet.

It should be noted that when the user's transaction request data packet is received, the statistical parameters of the user's transaction behavior can be obtained according to the transaction request data packet, which can be realized in a variety of ways. The following two methods are taken as examples for illustration. Of course, at least two ways can also be used to implement in combination. In addition, the method of acquiring the statistical parameters of the user's transaction behavior according to the transaction request data packet may be other methods according to the actual situation, which is not limited in this embodiment. Wherein, the user's transaction request may be operations such as registration, transaction, transfer, and transfer of financial assets performed by the user on the financial platform, and this embodiment does not limit specific transaction operations.

Specifically, one of the ways to obtain the user's transaction behavior statistical parameters according to the transaction request data packet is: obtain the data packet header and timing information according to the transaction request data packet; obtain the characteristics of the data packet header and the timing information information, and generate the current transaction behavior flow value according to the characteristic information; generate the user's transaction behavior statistical parameters according to the current transaction behavior flow value. Among them, the transaction request data packet of the current system network is obtained, the characteristic data collection is performed on the behavior characteristics of the transaction request data packet, the data packet header and timing information are obtained, and the time change trend of specific parameters in the transaction request data packet is mainly concerned, and specific time series of parameters to get time series information. In addition, detection and analysis can also be performed using time series characteristic changes of multiple parameters, and more types of traffic anomalies can be detected in a wider range.

Specifically, another way to obtain the user's transaction behavior statistical parameters according to the transaction request data packet is: obtain the transaction request data packet of the current system network, collect the characteristic data of the behavior characteristics of the transaction request data packet, and analyze the collected The feature data is used to extract the network behavior statistical parameters, and the network behavior statistical parameters are used as the user's transaction behavior statistical parameters.

A judging module 20, configured to judge whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters.

It should be understood that before the user's transaction request is distributed to limit the transaction flow, it is necessary to set the preset transaction behavior parameters. There are many ways to set the preset transaction behavior parameters. The following is an example of one of the ways For illustration, of course, the method of setting the preset transaction behavior parameters can also be other methods according to the actual situation, which is not limited in this embodiment. Specifically, one of the ways to obtain the statistical parameters of the user's transaction behavior according to the transaction request data packet is: construct a normal transaction flow model; obtain the predicted normal behavior flow value through the normal transaction flow model based on a preset time series analysis algorithm; The predicted normal behavior flow value generates preset transaction behavior parameters.

It is easy to understand that a typical distributed network can enable users to access the content of the financial platform nearby, which greatly improves the transaction efficiency of the financial platform. However, the distributed network is widely distributed on multiple links in the communication network of the financial platform, which causes an attack on the communication network of the financial platform at the same time, and the abnormal network is distributed on multiple links in the communication network of the financial platform. From the perspective of the road, the abnormal traffic is small and difficult to detect. However, when multiple links are aggregated, the total abnormal traffic is very large, which can have a great impact on the operation of the communication network of the financial platform. In this embodiment, combined with the characteristic information of distributed network traffic abnormalities in the financial platform communication network, the preset time series analysis algorithm is used to obtain the predicted normal behavior traffic value, and the predicted normal behavior traffic value is compared with the current transaction behavior traffic value to generate a network Transaction flow innovation sequence of flow.

Specifically, the predicted normal behavior flow value is obtained according to the preset transaction behavior parameters, and the current transaction behavior flow value is obtained according to the transaction behavior statistical parameters; the predicted normal behavior flow value is compared with the current transaction behavior flow value , to obtain a transaction flow innovation sequence; analyze the transaction flow innovation sequence, and judge whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis result. Among them, the sequential analysis method can be used to analyze the characteristics of the transaction flow innovation sequence of multiple links to judge whether the transaction behavior statistical parameters meet the preset transaction behavior parameters, that is, to analyze whether the abnormal behavior of distributed network traffic occurs, and then control the user transaction flow.

A decision-making module 30, configured to generate a defense request and send the defense request to a defense request server when the transaction behavior statistical parameters do not meet the preset transaction behavior parameters, so that the defense request server passes the defense request server. Request and preset throttling decisions determine throttling nodes.

It should be noted that when it is judged that the statistical parameters of transaction behavior do not meet the preset transaction behavior parameters, it is necessary to determine the current limiting node to analyze the abnormal behavior of distributed network traffic, and then control the user's transaction flow according to the current limiting node. Specifically, generate a defense request and send the defense request to the defense request server, so that the defense request server builds a traffic tree through the defense request and a preset attack source tracking strategy, and determines the target attacker according to the traffic tree. tree, and determine the current limiting node through the target attack subtree according to the preset current limiting decision. Among them, the defense request server DSP selects the attack source tracking (IP traceback) technology according to the specific situation, and can reconstruct a traffic tree with the abnormal behavior of network traffic as the root, and can separate the attack subtree from the traffic tree. The tracking results can obtain the most suitable current limiting position, that is, the current limiting node. The current limiting node is the leaf node of the traffic tree. According to the attack source tracking results, you can also know which current limiters the attack flow has passed through, so that it can be targeted Select the current limiting node for current limiting to improve the current limiting effect.

The control module 40 is configured to receive the rate-limiting node fed back by the defense request server, and control user transaction flow according to the rate-limiting node.

It should be understood that, receiving the current limiting node fed back by the defense request server, and determining the leaf node information corresponding to the current limiting node; determining the current limiting quota corresponding to the current limiting node according to the leaf node information, and determining the current limiting quota corresponding to the current limiting node according to the The preset current limiting decision determines the preset packet loss probability; the user transaction flow is controlled according to the current limit quota and the preset packet loss probability. Among them, the leaf node information is the basic information of each leaf node. The basic information can include such as node IP address, node status (whether current limiting, current limiting quota, current limiting time limit, whether there is attack flow passing through) and information collected from the node. Leaf node information is an important basis for controlling user transaction traffic, and leaf node information can also save the current limiting results obtained from preset current limiting decisions.

The distributed transaction current limiting device described in this embodiment includes an acquisition module 10, which is used to obtain the user's transaction behavior statistical parameters according to the transaction request data packet when receiving the user's transaction request data packet; the judging module 20 uses In judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters; the decision-making module 30 is used to generate a defense request and send the defense request when the transaction behavior statistics parameters do not conform to the preset transaction behavior parameters to the defense request server, so that the defense request server determines the current limit node through the defense request and the preset current limit decision; the control module 40 is configured to receive the current limit node fed back by the defense request server, and according to the limit Flow nodes control user transaction flow.

In an embodiment, the judging module 20 is further configured to obtain the predicted normal behavior flow value according to the preset transaction behavior parameters, and obtain the current transaction behavior flow value according to the transaction behavior statistical parameters;

Comparing the predicted normal behavior flow value with the current transaction flow value to obtain a transaction flow innovation sequence;

Analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters according to the analysis result.

In an embodiment, the judging module 20 is further configured to determine corresponding statistical features according to the transaction flow innovation sequence;

analyzing the statistical features based on a preset multivariate sequential analysis algorithm to obtain sample statistics;

performing a correlation analysis on the sample statistics according to a preset correlation test algorithm to obtain a correlation analysis result;

According to the correlation analysis result, it is judged whether the transaction behavior statistical parameters conform to the preset transaction behavior parameters.

In an embodiment, the obtaining module 10 is further configured to obtain the data packet header and timing information according to the transaction request data packet;

Obtaining the characteristic information of the data packet header and the timing information, and generating a current transaction behavior flow value according to the characteristic information;

Generate transaction behavior statistical parameters of the user according to the current transaction behavior flow value.

In one embodiment, the acquisition module 10 is also used to construct a normal transaction flow model;

Obtaining predicted normal behavior flow values through the transaction normal flow model based on a preset time series analysis algorithm;

Generate preset transaction behavior parameters according to the predicted normal behavior flow value.

In an embodiment, the decision-making module 30 is further configured to generate a defense request and send the defense request to the defense request server, so that the defense request server can construct the defense request and the preset attack source tracking strategy A traffic tree, determining a target attack subtree according to the traffic tree, and determining a current limiting node through the target attack subtree according to a preset current limiting decision.

In an embodiment, the control module 40 is further configured to receive the current limiting node fed back by the defense request server, and determine leaf node information corresponding to the current limiting node;

determining the current limiting quota corresponding to the current limiting node according to the leaf node information, and determining the preset packet loss probability according to the preset current limiting decision;

User transaction traffic is controlled according to the current limit quota and the preset packet loss probability.

For other embodiments or specific implementations of the distributed transaction current limiting device of the present invention, reference may be made to the above-mentioned embodiments of the distributed transaction current limiting method, which will not be repeated here.

It should be understood that the above is only an example, and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings according to needs, and the present invention is not limited thereto.

It should be noted that the workflow described above is only illustrative and does not limit the protection scope of the present invention. In practical applications, those skilled in the art can select part or all of them to implement according to actual needs. The purpose of the scheme of this embodiment is not limited here.

In addition, for technical details that are not described in detail in this embodiment, refer to the distributed transaction current limiting method provided by any embodiment of the present invention, which will not be repeated here.

Furthermore, it should be noted that in this document, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or system comprising a set of elements includes not only those elements, but also other elements not expressly listed, or elements inherent in such a process, method, article, or system. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article or system comprising that element.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as a read-only memory (Read Only Memory) , ROM)/RAM, magnetic disk, optical disk), including several instructions to make a terminal device (which can be a mobile phone, computer, server, or network device, etc.) execute the methods described in various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technical fields , are all included in the scope of patent protection of the present invention in the same way.

Claims (8)

1. A distributed transaction current limiting method is characterized in that the distributed transaction current limiting method comprises the following steps:

when a transaction request data packet of a user is received, acquiring a data packet header and time sequence information according to the transaction request data packet, acquiring characteristic information of the data packet header and the time sequence information, generating a current transaction behavior flow value according to the characteristic information, and generating a transaction behavior statistical parameter of the user according to the current transaction behavior flow value;

judging whether the transaction behavior statistical parameters accord with preset transaction behavior parameters or not;

when the transaction behavior statistical parameters do not accord with the preset transaction behavior parameters, generating a defense request and sending the defense request to a defense request server so that the defense request server constructs a flow tree through the defense request and a preset attack source tracking strategy, determining a target attack sub-tree according to the flow tree, and determining a current limiting node through the target attack sub-tree according to a preset current limiting decision;

and receiving the current limiting node fed back by the defense request server, and controlling the transaction flow of the user according to the current limiting node.

2. The distributed transaction current limiting method of claim 1, wherein the step of determining whether the transaction behavior statistical parameter meets a preset transaction behavior parameter comprises:

acquiring a predicted normal behavior flow value according to the preset transaction behavior parameters, and acquiring a current transaction behavior flow value according to the transaction behavior statistical parameters;

comparing the predicted normal behavior flow value with the current transaction behavior flow value to obtain a transaction flow innovation sequence;

and analyzing the transaction flow innovation sequence, and judging whether the transaction behavior statistical parameters accord with preset transaction behavior parameters or not according to the analysis result.

3. The distributed transaction current limiting method according to claim 2, wherein the step of analyzing the transaction flow information sequence and determining whether the transaction behavior statistical parameter meets a preset transaction behavior parameter according to the analysis result comprises:

determining corresponding statistical characteristics according to the transaction flow innovation sequence;

analyzing the statistical characteristics based on a preset multivariate sequential analysis algorithm to obtain sample statistics;

performing correlation analysis on the sample statistics according to a preset correlation test algorithm to obtain a correlation analysis result;

and judging whether the transaction behavior statistical parameters accord with preset transaction behavior parameters or not according to the correlation analysis result.

4. The distributed transaction current limiting method of claim 1, wherein before the step of determining whether the transaction behavior statistical parameter meets a preset transaction behavior parameter, the method further comprises:

constructing a normal transaction flow model;

acquiring a predicted normal behavior flow value through the transaction normal flow model based on a preset time sequence analysis algorithm;

and generating a preset transaction behavior parameter according to the predicted normal behavior flow value.

5. The distributed transaction throttling method of any of claims 1 to 4, wherein the step of the throttling node receiving the defensive request server feedback controlling the user transaction traffic according to the throttling node comprises:

receiving a current limiting node fed back by the defense request server, and determining leaf node information corresponding to the current limiting node;

determining a current limit corresponding to a current limit node according to the leaf node information, and determining a preset packet loss probability according to the preset current limit decision;

and controlling the transaction flow of the user according to the current limit and the preset packet loss probability.

6. A distributed transaction current limiting device, the distributed transaction current limiting device comprising:

the acquisition module is used for acquiring transaction behavior statistical parameters of a user according to a transaction request data packet when the transaction request data packet of the user is received;

the judging module is used for judging whether the transaction behavior statistical parameters accord with preset transaction behavior parameters or not;

the decision module is used for generating a defense request and sending the defense request to a defense request server when the transaction behavior statistical parameter does not accord with the preset transaction behavior parameter, so that the defense request server determines a current limiting node through the defense request and a preset current limiting decision;

the control module is used for receiving the current limiting node fed back by the defense request server and controlling the transaction flow of the user according to the current limiting node;

the acquisition module is further configured to acquire a data packet header and timing information according to the transaction request data packet, acquire feature information of the data packet header and the timing information, generate a current transaction behavior flow value according to the feature information, and generate a transaction behavior statistical parameter of the user according to the current transaction behavior flow value;

the decision module is further used for generating a defense request and sending the defense request to a defense request server, so that the defense request server constructs a flow tree through the defense request and a preset attack source tracking strategy, a target attack sub-tree is determined according to the flow tree, and a current limiting node is determined through the target attack sub-tree according to a preset current limiting decision.

7. A distributed transaction current limiting device, the distributed transaction current limiting device comprising: a memory, a processor, and a distributed transaction current limiting program stored on the memory and executable on the processor, the distributed transaction current limiting program configured to implement the steps of the distributed transaction current limiting method of any of claims 1 to 5.

8. A storage medium having stored thereon a distributed transaction current limiting program which, when executed by a processor, performs the steps of the distributed transaction current limiting method of any of claims 1 to 5.

Images